Malicious PDF — malware analysis report

Static analysis result for SHA-256 bc7668ce1a7459d3…

MALICIOUS

PDF

49.1 KB Authoring application: ImageMagick
MD5: 86fa72a70e02ae32289fea901c614270 SHA-1: 421cce74e5f0790fcb074bfea3aef6009f2e5204 SHA-256: bc7668ce1a7459d3d65072ccd011ff5c217d54fc3121dd203bf058127d406d85
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.isp.boiseastro.org/uploads/1/3/0/2/130289652/xiwimetoxa.pdf
    • http://mytorialex.com/uploads/1/3/0/7/130776502/35b0d9087b.pdf
    • http://sixpackcoaching.com/uploads/1/3/0/3/130379051/9702043.pdf
    • http://httpsecurityscan.com/uploads/1/3/0/4/130489122/betejuzigo-jejufizupu-fimivukibixu-wumafidofikawo.pdf
    • http://bhmiii.com/uploads/1/3/0/5/130550738/4506956.pdf
    • http://greenchicbeauty.com/uploads/1/3/0/2/130288630/3811590.pdf
    • http://ascakes.catering/uploads/1/3/0/3/130323390/xusepizetifegosozuf.pdf
    • http://omgradine.com/uploads/1/3/0/6/130620873/notasotew.pdf
    • http://watercolorcreativitylessons.com/uploads/1/3/0/2/130272266/8931086.pdf
    • http://nashobaspeechandfeeding.net/uploads/1/3/0/3/130324164/gafidawami_vefovaxefizet.pdf
    • http://www.starbrightgriefguidance.com/uploads/1/3/0/7/130740497/679606.pdf
    • http://atlagit.com/uploads/1/3/0/6/130603943/acfda6a6.pdf
    • http://www.samonoid.co.uk/uploads/1/3/0/6/130639147/kifalogituda.pdf
    • http://thecubeguys.net/uploads/1/3/0/4/130490328/4213450.pdf
    • http://laextraordinaire.com/uploads/1/3/0/5/130539102/kenonewo.pdf
    • http://rebeccahelm.net/uploads/1/3/0/7/130739928/9126284.pdf
    • http://kgboutiquedesigns.com/uploads/1/3/0/7/130738889/99f1d.pdf
    • http://chanabarriger.com/uploads/1/3/0/6/130621826/pudidedomizowusuv.pdf
    • http://the-pampered-hare.com/uploads/1/3/0/7/130776655/7f0fede5a5dbe.pdf
    • http://msmariecrafts.com/uploads/1/3/0/5/130589244/8691927.pdf
    • http://amelindaberube.com/uploads/1/3/0/8/130813786/2827593.pdf
    • http://ladyslipperstudios.com/uploads/1/3/0/7/130740561/katubixevo-vowotitoma.pdf
    • http://newbeginningsinvestorsllc.com/uploads/1/3/0/4/130435716/4f6eb.pdf
    • http://perapalace2018placeholder.devsite-1.com/uploads/1/3/0/5/130544413/130544413.html#acca+past+exams+f5
    • http://crofoot.dss.ucdavis.edu/uploads/1/3/0/4/130476624/36cb575ad9.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004386.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4386 16036 bytes
font_01_sfnt_off00005b03.bin
493ff69d3090c80ef77c25b861e69649d33fa36958db8de54116a01c869017cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B03 8744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.